6 Guidelines for Governing AI

For the first 10 years of my career, I worked in product management and data analytics by myself. I wrote database queries that pulled numbers out of corporate systems, built statistical models to predict what customers would buy, and shipped data pipelines that moved information between business systems. I built and scaled analytics teams at Best Buy and Target, studying how customers shop and what stores should stock. Today I lead enterprise AI transformation at Lowe’s, the Fortune 100 home improvement retailer. The goal is not to sell artificial intelligence; it is to use it to deliver useful expertise at the moment a customer needs it. In retail and other customer-facing industries, virtual assistants can help people address everyday questions—such as how to repair a leaky faucet—while guiding them toward relevant products, services, or next steps. As these capabilities become more common, technology roles are changing. The work is no longer limited to building AI systems; it also includes defining how they operate: which decisions they can make autonomously, when they must escalate to a person, and which actions must remain off-limits. That shift—from building AI systems to governing them—is coming for anyone who is accountable for what such systems produce. Not the casual user typing into a chatbot but the engineers, product managers, analysts, and business operators who sign off on work a machine drafted. It is the subject of the book I recently coauthored, The Enterprise Brain. I call the change the “governor shift,” from executing tasks yourself to setting the intent, principles, and boundaries within systems that execute them for you. Business operators might not write code; they will decide which pricing exceptions an agent may approve and which it must escalate. That is governing. A 2025 report from MIT Media Lab’s Project NANDA found that, despite an estimated US $30 billion to $40 billion in enterprise generative-AI investment, the vast majority of organizations in its dataset had not yet demonstrated measurable profit-and-loss impact. The report estimated that only about 5 percent of integrated pilots were generating substantial value, underscoring how difficult it remains to move from experimentation to scaled business outcomes. Researchers named the pattern the GenAI Divide, the term I adopted for the book. The companies rarely lack technology; they use the same models as the 5 percent that are winners. But they lack people who can direct the systems and stand behind the results. Guidelines to follow Here are six guidelines. Recognize when you have become “human middleware.” In software, “middleware” is the code that sits between two systems and passes information back and forth. Many of us have become its human version. Take an honest look at your week. How much time is spent pulling data out of one tool, reformatting it, and routing it to another team? I call this the “administrator trap,” which is set by the architecture, not by the people caught in it. Relaying is what AI agents now do well. But they cannot judge which numbers deserve attention, which risks are real, or which compromises are worth making. Trade rules for principles. For many years, workers used rules to manage their work. Refunds for a product over a certain amount needed a signature from upper management, for example. Writing code needed two reviewers. Rules work at human speed. But rules break when a system makes thousands of decisions per hour and meets situations no rulebook anticipated, such as a complaint covered by three different policies. A rule says to do exactly this specific thing; a principle says to achieve the outcome without crossing certain lines. Governing AI means writing those principles in priority order so the system settles its own conflicts the way a well-led team does when the manager is not available. Never harm the customer. Tell the truth even if the company loses a sale. Protect the economics, and then move quickly. Underneath sits a question of decision rights: the formal authority over who or what may make a given call. Writing down the answers in what I call a “library of principles” is now core leadership work, whether you’re a technologist or a business owner. Write your culture into your code. Many companies have turned their values into posters that hang on office walls. But an AI agent cannot read the posters. Instead, write your governance as code. Include your values and policies as machine-readable instructions that the AI agent will follow automatically. Do so in three layers. The top is the constitution, which states the rules an agent may never break, and never state a fact it cannot support. The second layer is the doctrine: how the business competes and the acceptable trade-offs to get there, such as protecting a long-term relationship over a short-term sale. At the bottom sits the playbook, which has the tactics used for one task. Install a trust thermostat, not a trust

Excerpt shown under the publisher's RSS terms · 172 words · full text and figures are on the publisher's site